Extracted

• • Target

    ec2453dbb46e27680ce11ee4d08137e0_JaffaCakes118

  • Size

    212KB

  • MD5

    ec2453dbb46e27680ce11ee4d08137e0

  • SHA1

    2831bdbbfc67cb405a2231ca7195f4040ee20d60

  • SHA256

    0214d1d58efc92256a064dd0a0d0a58c66f576eb260812dbd4905fdde0011dc6

  • SHA512

    1f2941be38a9fa7aaec3ad8e64b2c90074d6f4d2fad60a4377597ca422c29c4a49881b1cea598eacb3e41bda25cab616dbf659db99ad728afa89282e75495519

  • SSDEEP

    3072:YLca+56U04VjKkXzpicDlsc3w5zaLjBet8AbWF:fjKkXzpicDGc0kBkA

  Score

  10^/10

  discoverydanabotbankerbotnetevasionpersistenceransomwaretrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2